Function sanitizeFtsQuery

packages/memos-core/src/storage/sqlite.ts:2888–2897

* Sanitize user input for FTS5 MATCH queries. * Strip FTS operators and special characters, then join tokens * with implicit AND (space-separated) for safe querying.

(raw: string)

 * with implicit AND (space-separated) for safe querying.
 */
function sanitizeFtsQuery(raw: string): string {
  const tokens = raw
    .replace(/[."""(){}[\]*:^~!@#$%&\\/<>,;'`-]/g, " ")
    .split(/\s+/)
    .map((t) => t.trim().replace(/^-+|-+$/g, ""))
    .filter((t) => t.length > 1)
    .filter((t) => !FTS_RESERVED.has(t.toUpperCase()));

  return tokens.join(" ");
}

const FTS_RESERVED = new Set(["AND", "OR", "NOT", "NEAR"]);